Worst ten TLDs for Malicious Domains as of Aug 2015

Many new top-level domains have become Internet’s “bad neighborhoods”.

[pageoneresults]

Many New Top-Level Domains Have Become Internet’s “Bad Neighborhoods”
[ARSTechnica.com...]

1. .zip (100.00%)
   
2. .review (100.00%)
   
3. .country (99.97%)
   
4. .kim (99.74%)
   
5. .cricket (99.57%)
   
6. .science (99.35%)
   
7. .work (98.20%)
   
8. .party (98.07%)
   
9. .gq (97.68%)
   
10. .link (96.98%)

[bill]

It has helped me filter for spam in a lot of cases. I just add the entire offending gTLD into my spam filter. Problem solved!

[engine]

That's a helpful list, and it's surprising to see some of those on there, especially as they are not the cheapest. Clearly, they are hoping to catch people unaware.

[lucy24]

.gq (97.68%)

This one threw me as I thought "wait, isn't that the Canadian government?" (Ongoing confusion between g as in .gc. and q as in .qc. -- which of course look identical in an underlined sans-serif link.) Guess not.

[jmccormac]

Pseudo-scientific rubbish by a bunch of clueless amateurs. The .zip gTLD isn't even active.

Regards...jmcc

[tangor]

My current whitelist is .com, .net, .org. I will any others which make sense as time goes by.

[Robert Charlton]

In terms of email, I've gotten lots of spam from .rocks and .info... and recently there's been a resurgence from .com. ;)

[piatkow]

Actually from those domains or spoofed "from" addresses?

[lucy24]

recently there's been a resurgence from .com

Well, cyberpromo was a dot com ;)

[jmccormac]

Looks like a bunch of bozos who weren't even aware that the number 1 gTLD there isn't even lauched were doing the "analysis" with crayons. Some of those gTLDs have problems with disposable domains but these people haven't a clue about the domain names business.

Regards...jmcc

[Robert Charlton]

Actually from those domains or spoofed "from" addresses?

From those actual domains, I believe, as the account on which I'm seeing them gives me the opportunity to add to my block list only when they're not spoofed.

The ISP in this case has also wised up, after several years of user complaints, and has implemented filters by TLD or ccTLD, which has simplified my life immensely.

(Maybe that's why I'm thinking there's been a resurgence in dot com spam... relatively speaking, after I filter the other tlds, it's almost all that's left.)